PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2024-41057

CVE-2024-41057

kernel: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()

Loading…

Severity

Moderate

Red Hat Product Security

7

CVSS 3.1

Review impact separately from score.

Published · July 29, 2024

Updated · October 29, 2026

Description

A potential use after free was found in the Linux kernel.

Statement

Red Hat Product Security has rated the attack complexity as high for the following reasons:

  1. To get this bug to work, precise ordering in concurrent operations on cache volumes/cookies need to be broken, thereby causing a race condition.
  2. Reproducing a use-after-free from a race is not very deterministic
  3. The state is super important as cachefiles_withdraw_cookies() are called only during specific lifecycle events.
  4. It can not be easily triggered by unprivileged users.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 · Use After Free